[Low] Patch apparmor for CVE-2023-53154

Author: durgajagadeesh

SPECS/apparmor/CVE-2023-53154.patch

@@ -0,0 +1,30 @@
+From 1dfb03ca74b78ff4a87b48a70b91a5cfc985f9c4 Mon Sep 17 00:00:00 2001
+From: dj_palli <v-dpalli@microsoft.com>
+Date: Thu, 12 Jun 2025 20:49:56 +0000
+Subject: [PATCH] Address CVE-2023-53154
+
+Upstream Patch Reference: https://github.com/DaveGamble/cJSON/commit/3ef4e4e730e5efd381be612df41e1ff3f5bb3c32
+
+---
+ binutils/cJSON.c | 5 +++++
+ 1 file changed, 5 insertions(+)
+
+diff --git a/binutils/cJSON.c b/binutils/cJSON.c
+index e85ac11..45c1c45 100644
+--- a/binutils/cJSON.c
++++ b/binutils/cJSON.c
+@@ -1650,6 +1650,11 @@ static cJSON_bool parse_object(cJSON * const item, parse_buffer * const input_bu
+             current_item = new_item;
+         }
+ 
++	if (cannot_access_at_index(input_buffer, 1))
++        {
++            goto fail; /* nothing comes after the comma */
++        }
++
+         /* parse the name of the child */
+         input_buffer->offset++;
+         buffer_skip_whitespace(input_buffer);
+-- 
+2.45.2
+

SPECS/apparmor/apparmor.spec

@@ -1,7 +1,7 @@
 Summary:        AppArmor is an effective and easy-to-use Linux application security system.
 Name:           apparmor
 Version:        3.0.4
-Release:        4%{?dist}
+Release:        5%{?dist}
 License:        GPLv2
 Vendor:         Microsoft Corporation
 Distribution:   Mariner
@@ -11,8 +11,11 @@ Source0:        https://launchpad.net/apparmor/3.0/3.0.4/+download/%{name}-%{ver
 Patch1:         apparmor-service-start-fix.patch
 Patch2:         CVE-2023-50471.patch
 Patch3:         CVE-2024-31755.patch
+Patch4:         CVE-2023-53154.patch
+
 # CVE-2016-1585 has no upstream fix as of 2020/09/28
 Patch100:       CVE-2016-1585.nopatch
+
 BuildRequires:  apr
 BuildRequires:  apr-util-devel
 BuildRequires:  autoconf
@@ -355,6 +358,9 @@ make DESTDIR=%{buildroot} install
 %exclude %{perl_archlib}/perllocal.pod
 
 %changelog
+* Fri Jun 13 2025 Durga Jagadeesh Palli <v-dpalli@microsoft.com> - 3.0.4-5
+- Patch CVE-2023-53154
+
 * Thu May 30 2024 Sumedh Sharma <sumsharma@microsoft.com> - 3.0.4-4
 - Add patch for CVE-2024-31755